aws

What it does

How to write it

aws SERVICE ACTION [--options] [--profile NAME] [--region REGION] [--query EXPR] [--output FORMAT]

Main parts

Most used services

configure / configure sso / sso login

Set up credentials.

sts get-caller-identity

Who am I?

s3 / s3api

Object storage (simple / full API).

ec2

Virtual machines, security groups, VPCs.

iam

Users, roles, policies.

eks

Kubernetes clusters (update-kubeconfig).

ecr

Container registry.

logs

CloudWatch Logs.

cloudformation

Templates.

ssm

Session Manager, Parameter Store.

secretsmanager

Secrets.

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Log in with SSO and check who you are

   $aws configure sso --profile lab
   $aws sso login --profile lab
   $aws sts get-caller-identity --profile lab

2. 2Work with S3

   $aws s3 mb s3://s0sta-lab-backups-2026 --region eu-central-1
   $aws s3 cp backup.tar.gz s3://s0sta-lab-backups-2026/daily/
   $aws s3 ls s3://s0sta-lab-backups-2026/daily/ --human-readable
   $aws s3 sync ./site s3://s0sta-lab-site --delete

3. 3Block public access and turn on encryption

   $aws s3api put-public-access-block --bucket s0sta-lab-backups-2026 --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
   $aws s3api put-bucket-encryption --bucket s0sta-lab-backups-2026 --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms"}}]}'

4. 4Share a file for one hour

   $aws s3 presign s3://s0sta-lab-backups-2026/daily/backup.tar.gz --expires-in 3600

5. 5List EC2 instances as a table

   $aws ec2 describe-instances --query "Reservations[].Instances[].{id:InstanceId,state:State.Name,ip:PublicIpAddress,name:Tags[?Key=='Name']|[0].Value}" --output table

6. 6Start and stop an instance

   $aws ec2 stop-instances --instance-ids i-0abc123def4567890
   $aws ec2 start-instances --instance-ids i-0abc123def4567890

7. 7Find security groups open to the world

   $aws ec2 describe-security-groups --query "SecurityGroups[?IpPermissions[?IpRanges[?CidrIp=='0.0.0.0/0']]].[GroupId,GroupName]" --output table

8. 8Connect without SSH keys (Session Manager)

   $aws ssm start-session --target i-0abc123def4567890

9. 9Use an EKS cluster

   $aws eks update-kubeconfig --name eks-lab --region eu-central-1
   $kubectl get nodes

10. 10Push an image to ECR

    $aws ecr get-login-password --region eu-central-1 | docker login --username AWS --password-stdin 123456789012.dkr.ecr.eu-central-1.amazonaws.com
    $docker push 123456789012.dkr.ecr.eu-central-1.amazonaws.com/shop:1.4.0

11. 11Read a secret

    $aws secretsmanager get-secret-value --secret-id prod/db --query SecretString --output text

12. 12Follow CloudWatch logs

    $aws logs tail /aws/eks/eks-lab/cluster --follow --since 10m

Nothing matches this filter.

Files

~/.aws/config

Profiles, regions, SSO settings.

~/.aws/credentials

Access keys (avoid; keep private if used).

Exit codes